./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor564338124 <...> Warning: Permanently added '10.128.0.92' (ED25519) to the list of known hosts. execve("./syz-executor564338124", ["./syz-executor564338124"], 0x7ffd1dadd7f0 /* 10 vars */) = 0 brk(NULL) = 0x5555607ea000 brk(0x5555607eae00) = 0x5555607eae00 arch_prctl(ARCH_SET_FS, 0x5555607ea480) = 0 set_tid_address(0x5555607ea750) = 5827 set_robust_list(0x5555607ea760, 24) = 0 rseq(0x5555607eada0, 0x20, 0, 0x53053053) = 0 prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlink("/proc/self/exe", "/root/syz-executor564338124", 4096) = 27 getrandom("\xde\x96\x87\x32\xb2\x9b\x06\xf9", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x5555607eae00 brk(0x55556080be00) = 0x55556080be00 brk(0x55556080c000) = 0x55556080c000 mprotect(0x7ff2b6a3a000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 rt_sigaction(SIGRTMIN, {sa_handler=SIG_IGN, sa_mask=[], sa_flags=0}, NULL, 8) = 0 rt_sigaction(SIGRT_1, {sa_handler=SIG_IGN, sa_mask=[], sa_flags=0}, NULL, 8) = 0 rt_sigaction(SIGSEGV, {sa_handler=0x7ff2b698e330, sa_mask=[], sa_flags=SA_RESTORER|SA_NODEFER|SA_SIGINFO, sa_restorer=0x7ff2b6997460}, NULL, 8) = 0 rt_sigaction(SIGBUS, {sa_handler=0x7ff2b698e330, sa_mask=[], sa_flags=SA_RESTORER|SA_NODEFER|SA_SIGINFO, sa_restorer=0x7ff2b6997460}, NULL, 8) = 0 unshare(CLONE_NEWPID) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5828 attached , child_tidptr=0x5555607ea750) = 5828 [pid 5828] set_robust_list(0x5555607ea760, 24) = 0 [pid 5828] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5828] getppid() = 0 [pid 5828] prlimit64(0, RLIMIT_AS, {rlim_cur=204800*1024, rlim_max=204800*1024}, NULL) = 0 [pid 5828] prlimit64(0, RLIMIT_MEMLOCK, {rlim_cur=32768*1024, rlim_max=32768*1024}, NULL) = 0 [pid 5828] prlimit64(0, RLIMIT_FSIZE, {rlim_cur=139264*1024, rlim_max=139264*1024}, NULL) = 0 [pid 5828] prlimit64(0, RLIMIT_STACK, {rlim_cur=1024*1024, rlim_max=1024*1024}, NULL) = 0 [pid 5828] prlimit64(0, RLIMIT_CORE, {rlim_cur=131072*1024, rlim_max=131072*1024}, NULL) = 0 [pid 5828] prlimit64(0, RLIMIT_NOFILE, {rlim_cur=256, rlim_max=256}, NULL) = 0 [pid 5828] unshare(CLONE_NEWNS) = 0 [pid 5828] mount(NULL, "/", NULL, MS_REC|MS_PRIVATE, NULL) = 0 [pid 5828] unshare(CLONE_NEWIPC) = 0 [pid 5828] unshare(CLONE_NEWCGROUP) = 0 [pid 5828] unshare(CLONE_NEWUTS) = 0 [pid 5828] unshare(CLONE_SYSVSEM) = 0 [pid 5828] openat(AT_FDCWD, "/proc/sys/kernel/shmmax", O_WRONLY|O_CLOEXEC) = 3 [pid 5828] write(3, "16777216", 8) = 8 [pid 5828] close(3) = 0 [pid 5828] openat(AT_FDCWD, "/proc/sys/kernel/shmall", O_WRONLY|O_CLOEXEC) = 3 [pid 5828] write(3, "536870912", 9) = 9 [pid 5828] close(3) = 0 [pid 5828] openat(AT_FDCWD, "/proc/sys/kernel/shmmni", O_WRONLY|O_CLOEXEC) = 3 [pid 5828] write(3, "1024", 4) = 4 [pid 5828] close(3) = 0 [pid 5828] openat(AT_FDCWD, "/proc/sys/kernel/msgmax", O_WRONLY|O_CLOEXEC) = 3 [pid 5828] write(3, "8192", 4) = 4 [pid 5828] close(3) = 0 [pid 5828] openat(AT_FDCWD, "/proc/sys/kernel/msgmni", O_WRONLY|O_CLOEXEC) = 3 [pid 5828] write(3, "1024", 4) = 4 [pid 5828] close(3) = 0 [pid 5828] openat(AT_FDCWD, "/proc/sys/kernel/msgmnb", O_WRONLY|O_CLOEXEC) = 3 [pid 5828] write(3, "1024", 4) = 4 [pid 5828] close(3) = 0 [pid 5828] openat(AT_FDCWD, "/proc/sys/kernel/sem", O_WRONLY|O_CLOEXEC) = 3 [pid 5828] write(3, "1024 1048576 500 1024", 21) = 21 [pid 5828] close(3) = 0 [pid 5828] getpid() = 1 [pid 5828] capget({version=_LINUX_CAPABILITY_VERSION_3, pid=1}, {effective=1<) = 0 [pid 5828] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5832 attached , child_tidptr=0x5555607ea750) = 3 [pid 5832] set_robust_list(0x5555607ea760, 24) = 0 [pid 5832] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5832] setpgid(0, 0) = 0 [pid 5832] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5832] write(3, "1000", 4) = 4 [pid 5832] close(3) = 0 executing program [pid 5832] write(1, "executing program\n", 18) = 18 [pid 5832] socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC) = 3 [pid 5832] socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC) = 4 [pid 5832] sendto(4, [{nlmsg_len=32, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x03\x00\x00\x00\x0c\x00\x02\x00\x6e\x6c\x38\x30\x32\x31\x31\x00"], 32, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 32 [pid 5832] recvfrom(4, [{nlmsg_len=2516, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=3}, "\x01\x02\x00\x00\x0c\x00\x02\x00\x6e\x6c\x38\x30\x32\x31\x31\x00\x06\x00\x01\x00\x24\x00\x00\x00\x08\x00\x03\x00\x01\x00\x00\x00\x08\x00\x04\x00\x00\x00\x00\x00\x08\x00\x05\x00\x4d\x01\x00\x00\x00\x09\x06\x00\x14\x00\x01\x00\x08\x00\x01\x00\x01\x00\x00\x00\x08\x00\x02\x00\x0e\x00\x00\x00\x14\x00\x02\x00\x08\x00\x01\x00\x02\x00\x00\x00\x08\x00\x02\x00\x1a\x00\x00\x00\x14\x00\x03\x00\x08\x00\x01\x00"...], 4096, 0, NULL, NULL) = 2516 [pid 5832] recvfrom(4, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=3}, {error=0, msg={nlmsg_len=32, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 [pid 5832] close(4) = 0 [pid 5832] ioctl(3, SIOCGIFINDEX, {ifr_name="wlan1", ifr_ifindex=12}) = 0 [pid 5832] sendmsg(3, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base="\x24\x00\x00\x00\x24\x00\x05\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00\x00\x00\x08\x00\x03\x00\x0c\x00\x00\x00\x08\x00\x05\x00\x02\x00\x00\x00", iov_len=36}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 36 [pid 5832] sendmsg(3, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base="\x30\x00\x00\x00\x24\x00\x05\x00\x00\x00\x00\x00\x00\x00\x00\x00\x2e\x00\x00\x00\x08\x00\x03\x00\x0c\x00\x00\x00\x0a\x00\x34\x00\x02\x02\x02\x02\x02\x02\x00\x00\x08\x00\x26\x00\x6c\x09\x00\x00", iov_len=48}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 48 [pid 5832] socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC) = 4 [pid 5832] sendto(4, [{nlmsg_len=40, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x03\x00\x00\x00\x13\x00\x02\x00\x4d\x41\x43\x38\x30\x32\x31\x31\x5f\x48\x57\x53\x49\x4d\x00\x00"], 40, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 40 [pid 5832] recvfrom(4, [{nlmsg_len=244, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=-539850526}, "\x01\x02\x00\x00\x13\x00\x02\x00\x4d\x41\x43\x38\x30\x32\x31\x31\x5f\x48\x57\x53\x49\x4d\x00\x00\x06\x00\x01\x00\x2c\x00\x00\x00\x08\x00\x03\x00\x01\x00\x00\x00\x08\x00\x04\x00\x00\x00\x00\x00\x08\x00\x05\x00\x1d\x00\x00\x00\x90\x00\x06\x00\x14\x00\x01\x00\x08\x00\x01\x00\x01\x00\x00\x00\x08\x00\x02\x00\x1a\x00\x00\x00\x14\x00\x02\x00\x08\x00\x01\x00\x02\x00\x00\x00\x08\x00\x02\x00\x0a\x00\x00\x00"...], 4096, 0, NULL, NULL) = 244 [pid 5832] recvfrom(4, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=-539850526}, {error=0, msg={nlmsg_len=40, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 [pid 5832] sendto(4, [{nlmsg_len=20, nlmsg_type=0x2c /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x01\x00\x00\x00"], 20, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 20 [pid 5832] recvfrom(4, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=-539850526}, {error=0, msg={nlmsg_len=20, nlmsg_type=0x2c /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 [pid 5832] sendto(4, [{nlmsg_len=100, nlmsg_type=0x2c /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x02\x00\x00\x00\x08\x00\x05\x00\x01\x00\x00\x00\x08\x00\x06\x00\x00\x00\x00\x00\x0a\x00\x01\x00\x08\x02\x11\x00\x00\x01\x00\x00\x33\x00\x03\x00\x50\x00\x00\x00\x08\x02\x11\x00\x00\x01\x08\x02\x11\x00\x00\x00\x08\x02\x11\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x64\x00\x01\x00\x00\x06\x02\x02\x02\x02\x02\x02\x01\x01\x02\x00"], 100, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 100 [pid 5832] recvfrom(4, [{nlmsg_len=120, nlmsg_type=NLMSG_ERROR, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=-539850526}, {error=-EINVAL, msg=[{nlmsg_len=100, nlmsg_type=0x2c /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x02\x00\x00\x00\x08\x00\x05\x00\x01\x00\x00\x00\x08\x00\x06\x00\x00\x00\x00\x00\x0a\x00\x01\x00\x08\x02\x11\x00\x00\x01\x00\x00\x33\x00\x03\x00\x50\x00\x00\x00\x08\x02\x11\x00\x00\x01\x08\x02\x11\x00\x00\x00\x08\x02\x11\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x64\x00\x01\x00\x00\x06\x02\x02\x02\x02\x02\x02\x01\x01\x02\x00"]}], 4096, 0, NULL, NULL) = 120 [pid 5832] close(4) = 0 [pid 5832] socket(AF_QIPCRTR, SOCK_DGRAM, 0) = 4 [pid 5832] socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC) = 5 [pid 5832] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 5832] ioctl(4, SIOCSIFHWADDR, {ifr_name="wlan1", ifr_hwaddr={sa_family=ARPHRD_ETHER, sa_data=00:00:00:00:00:00}}) = -1 EADDRNOTAVAIL (Cannot assign requested address) [pid 5832] close(3) = 0 [ 64.913151][ T5832] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [pid 5832] close(4) = 0 [pid 5832] close(5) = 0 [pid 5832] close(6) = -1 EBADF (Bad file descriptor) [pid 5832] close(7) = -1 EBADF (Bad file descriptor) [pid 5832] close(8) = -1 EBADF (Bad file descriptor) [pid 5832] close(9) = -1 EBADF (Bad file descriptor) [pid 5832] close(10) = -1 EBADF (Bad file descriptor) [pid 5832] close(11) = -1 EBADF (Bad file descriptor) [pid 5832] close(12) = -1 EBADF (Bad file descriptor) [pid 5832] close(13) = -1 EBADF (Bad file descriptor) [pid 5832] close(14) = -1 EBADF (Bad file descriptor) [pid 5832] close(15) = -1 EBADF (Bad file descriptor) [pid 5832] close(16) = -1 EBADF (Bad file descriptor) [pid 5832] close(17) = -1 EBADF (Bad file descriptor) [pid 5832] close(18) = -1 EBADF (Bad file descriptor) [pid 5832] close(19) = -1 EBADF (Bad file descriptor) [pid 5832] close(20) = -1 EBADF (Bad file descriptor) [pid 5832] close(21) = -1 EBADF (Bad file descriptor) [pid 5832] close(22) = -1 EBADF (Bad file descriptor) [pid 5832] close(23) = -1 EBADF (Bad file descriptor) [pid 5832] close(24) = -1 EBADF (Bad file descriptor) [pid 5832] close(25) = -1 EBADF (Bad file descriptor) [pid 5832] close(26) = -1 EBADF (Bad file descriptor) [pid 5832] close(27) = -1 EBADF (Bad file descriptor) [pid 5832] close(28) = -1 EBADF (Bad file descriptor) [pid 5832] close(29) = -1 EBADF (Bad file descriptor) [pid 5832] exit_group(0) = ? [pid 5832] +++ exited with 0 +++ [pid 5828] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=3, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} --- [pid 5828] restart_syscall(<... resuming interrupted clone ...>) = 0 [pid 5828] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5833 attached , child_tidptr=0x5555607ea750) = 4 [pid 5833] set_robust_list(0x5555607ea760, 24) = 0 [pid 5833] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5833] setpgid(0, 0) = 0 [pid 5833] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5833] write(3, "1000", 4) = 4 [pid 5833] close(3) = 0 [pid 5833] write(1, "executing program\n", 18executing program ) = 18 [pid 5833] socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC) = 3 [pid 5833] socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC) = 4 [pid 5833] sendto(4, [{nlmsg_len=32, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x03\x00\x00\x00\x0c\x00\x02\x00\x6e\x6c\x38\x30\x32\x31\x31\x00"], 32, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 32 [pid 5833] recvfrom(4, [{nlmsg_len=2516, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=4}, "\x01\x02\x00\x00\x0c\x00\x02\x00\x6e\x6c\x38\x30\x32\x31\x31\x00\x06\x00\x01\x00\x24\x00\x00\x00\x08\x00\x03\x00\x01\x00\x00\x00\x08\x00\x04\x00\x00\x00\x00\x00\x08\x00\x05\x00\x4d\x01\x00\x00\x00\x09\x06\x00\x14\x00\x01\x00\x08\x00\x01\x00\x01\x00\x00\x00\x08\x00\x02\x00\x0e\x00\x00\x00\x14\x00\x02\x00\x08\x00\x01\x00\x02\x00\x00\x00\x08\x00\x02\x00\x1a\x00\x00\x00\x14\x00\x03\x00\x08\x00\x01\x00"...], 4096, 0, NULL, NULL) = 2516 [pid 5833] recvfrom(4, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=4}, {error=0, msg={nlmsg_len=32, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 [pid 5833] close(4) = 0 [pid 5833] ioctl(3, SIOCGIFINDEX, {ifr_name="wlan1", ifr_ifindex=12}) = 0 [pid 5833] sendmsg(3, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base="\x24\x00\x00\x00\x24\x00\x05\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00\x00\x00\x08\x00\x03\x00\x0c\x00\x00\x00\x08\x00\x05\x00\x02\x00\x00\x00", iov_len=36}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 36 [pid 5833] sendmsg(3, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base="\x30\x00\x00\x00\x24\x00\x05\x00\x00\x00\x00\x00\x00\x00\x00\x00\x2e\x00\x00\x00\x08\x00\x03\x00\x0c\x00\x00\x00\x0a\x00\x34\x00\x02\x02\x02\x02\x02\x02\x00\x00\x08\x00\x26\x00\x6c\x09\x00\x00", iov_len=48}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 48 [pid 5833] socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC) = 4 [pid 5833] sendto(4, [{nlmsg_len=40, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x03\x00\x00\x00\x13\x00\x02\x00\x4d\x41\x43\x38\x30\x32\x31\x31\x5f\x48\x57\x53\x49\x4d\x00\x00"], 40, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 40 [pid 5833] recvfrom(4, [{nlmsg_len=244, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=-837860695}, "\x01\x02\x00\x00\x13\x00\x02\x00\x4d\x41\x43\x38\x30\x32\x31\x31\x5f\x48\x57\x53\x49\x4d\x00\x00\x06\x00\x01\x00\x2c\x00\x00\x00\x08\x00\x03\x00\x01\x00\x00\x00\x08\x00\x04\x00\x00\x00\x00\x00\x08\x00\x05\x00\x1d\x00\x00\x00\x90\x00\x06\x00\x14\x00\x01\x00\x08\x00\x01\x00\x01\x00\x00\x00\x08\x00\x02\x00\x1a\x00\x00\x00\x14\x00\x02\x00\x08\x00\x01\x00\x02\x00\x00\x00\x08\x00\x02\x00\x0a\x00\x00\x00"...], 4096, 0, NULL, NULL) = 244 [pid 5833] recvfrom(4, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=-837860695}, {error=0, msg={nlmsg_len=40, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 [pid 5833] sendto(4, [{nlmsg_len=20, nlmsg_type=0x2c /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x01\x00\x00\x00"], 20, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 20 [pid 5833] recvfrom(4, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=-837860695}, {error=0, msg={nlmsg_len=20, nlmsg_type=0x2c /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 [pid 5833] sendto(4, [{nlmsg_len=100, nlmsg_type=0x2c /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x02\x00\x00\x00\x08\x00\x05\x00\x01\x00\x00\x00\x08\x00\x06\x00\x00\x00\x00\x00\x0a\x00\x01\x00\x08\x02\x11\x00\x00\x01\x00\x00\x33\x00\x03\x00\x50\x00\x00\x00\x08\x02\x11\x00\x00\x01\x08\x02\x11\x00\x00\x00\x08\x02\x11\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x64\x00\x01\x00\x00\x06\x02\x02\x02\x02\x02\x02\x01\x01\x02\x00"], 100, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 100 [pid 5833] recvfrom(4, [{nlmsg_len=168, nlmsg_type=0x2c /* NLMSG_??? */, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=0}, "\x02\x01\x00\x00\x0a\x00\x02\x00\x08\x02\x11\x00\x00\x00\x00\x00\x50\x00\x03\x00\x80\x00\x00\x00\xff\xff\xff\xff\xff\xff\x08\x02\x11\x00\x00\x00\x50\x50\x50\x50\x50\x50\x00\x00\x03\x52\xa1\xd0\x0e\x29\x06\x00\x64\x00\x02\x00\x00\x06\x10\x10\x10\x10\x10\x10\x01\x08\x82\x84\x8b\x96\x0c\x12\x18\x24\x03\x01\x01\x06\x02\x00\x00\x32\x04\x30\x48\x60\x6c\xdd\x07\x00\x50\xf2\x02\x00\x01\x00\x08\x00\x04\x00"...], 4096, 0, NULL, NULL) = 168 [pid 5833] close(4) = 0 [pid 5833] socket(AF_QIPCRTR, SOCK_DGRAM, 0) = 4 [pid 5833] socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC) = 5 [pid 5833] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} --- [pid 5833] ioctl(4, SIOCSIFHWADDR, {ifr_name="wlan1", ifr_hwaddr={sa_family=ARPHRD_ETHER, sa_data=00:00:00:00:00:00}}) = -1 EADDRNOTAVAIL (Cannot assign requested address) [pid 5833] close(3) = 0 [pid 5833] close(4) = 0 [pid 5833] close(5) = 0 [ 65.330356][ T46] wlan1: No basic rates, using min rate instead [ 65.338697][ T46] wlan1: authenticate with 08:02:11:00:00:00 (local address=08:02:11:00:00:01) [ 65.342507][ T5833] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 65.349114][ T46] wlan1: send auth to 08:02:11:00:00:00 (try 1/3) [pid 5833] close(6) = -1 EBADF (Bad file descriptor) [pid 5833] close(7) = -1 EBADF (Bad file descriptor) [pid 5833] close(8) = -1 EBADF (Bad file descriptor) [pid 5833] close(9) = -1 EBADF (Bad file descriptor) [pid 5833] close(10) = -1 EBADF (Bad file descriptor) [pid 5833] close(11) = -1 EBADF (Bad file descriptor) [pid 5833] close(12) = -1 EBADF (Bad file descriptor) [pid 5833] close(13) = -1 EBADF (Bad file descriptor) [pid 5833] close(14) = -1 EBADF (Bad file descriptor) [pid 5833] close(15) = -1 EBADF (Bad file descriptor) [pid 5833] close(16) = -1 EBADF (Bad file descriptor) [pid 5833] close(17) = -1 EBADF (Bad file descriptor) [pid 5833] close(18) = -1 EBADF (Bad file descriptor) [pid 5833] close(19) = -1 EBADF (Bad file descriptor) [pid 5833] close(20) = -1 EBADF (Bad file descriptor) [ 65.469948][ T1094] wlan1: send auth to 08:02:11:00:00:00 (try 2/3) [pid 5833] close(21) = -1 EBADF (Bad file descriptor) [pid 5833] close(22) = -1 EBADF (Bad file descriptor) [pid 5833] close(23) = -1 EBADF (Bad file descriptor) [pid 5833] close(24) = -1 EBADF (Bad file descriptor) [pid 5833] close(25) = -1 EBADF (Bad file descriptor) [pid 5833] close(26) = -1 EBADF (Bad file descriptor) [pid 5833] close(27) = -1 EBADF (Bad file descriptor) [pid 5833] close(28) = -1 EBADF (Bad file descriptor) [pid 5833] close(29) = -1 EBADF (Bad file descriptor) [pid 5833] exit_group(0) = ? [pid 5833] +++ exited with 0 +++ [pid 5828] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=4, si_uid=0, si_status=0, si_utime=0, si_stime=3 /* 0.03 s */} --- [pid 5828] restart_syscall(<... resuming interrupted clone ...>) = 0 [pid 5828] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5835 attached , child_tidptr=0x5555607ea750) = 5 [pid 5835] set_robust_list(0x5555607ea760, 24) = 0 [pid 5835] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5835] setpgid(0, 0) = 0 [pid 5835] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [ 65.579194][ T1094] wlan1: send auth to 08:02:11:00:00:00 (try 3/3) [pid 5835] write(3, "1000", 4) = 4 [pid 5835] close(3) = 0 executing program [pid 5835] write(1, "executing program\n", 18) = 18 [pid 5835] socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC) = 3 [pid 5835] socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC) = 4 [pid 5835] sendto(4, [{nlmsg_len=32, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x03\x00\x00\x00\x0c\x00\x02\x00\x6e\x6c\x38\x30\x32\x31\x31\x00"], 32, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 32 [pid 5835] recvfrom(4, [{nlmsg_len=2516, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=5}, "\x01\x02\x00\x00\x0c\x00\x02\x00\x6e\x6c\x38\x30\x32\x31\x31\x00\x06\x00\x01\x00\x24\x00\x00\x00\x08\x00\x03\x00\x01\x00\x00\x00\x08\x00\x04\x00\x00\x00\x00\x00\x08\x00\x05\x00\x4d\x01\x00\x00\x00\x09\x06\x00\x14\x00\x01\x00\x08\x00\x01\x00\x01\x00\x00\x00\x08\x00\x02\x00\x0e\x00\x00\x00\x14\x00\x02\x00\x08\x00\x01\x00\x02\x00\x00\x00\x08\x00\x02\x00\x1a\x00\x00\x00\x14\x00\x03\x00\x08\x00\x01\x00"...], 4096, 0, NULL, NULL) = 2516 [pid 5835] recvfrom(4, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=5}, {error=0, msg={nlmsg_len=32, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 [pid 5835] close(4) = 0 [pid 5835] ioctl(3, SIOCGIFINDEX, {ifr_name="wlan1", ifr_ifindex=12}) = 0 [ 65.699081][ T1094] wlan1: authentication with 08:02:11:00:00:00 timed out [ 65.706643][ T1094] ================================================================== [ 65.714737][ T1094] BUG: KASAN: slab-use-after-free in __lock_acquire+0x78/0x2100 [ 65.722398][ T1094] Read of size 8 at addr ffff888011d45cb8 by task kworker/u8:6/1094 [ 65.730367][ T1094] [ 65.732707][ T1094] CPU: 1 UID: 0 PID: 1094 Comm: kworker/u8:6 Not tainted 6.13.0-rc1-syzkaller-00230-g15bfb14727bc #0 [ 65.743536][ T1094] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/25/2024 [ 65.753585][ T1094] Workqueue: events_unbound cfg80211_wiphy_work [ 65.759839][ T1094] Call Trace: [ 65.763108][ T1094] [ 65.766026][ T1094] dump_stack_lvl+0x241/0x360 [ 65.770957][ T1094] ? __pfx_dump_stack_lvl+0x10/0x10 [ 65.776144][ T1094] ? __pfx__printk+0x10/0x10 [ 65.780729][ T1094] ? _printk+0xd5/0x120 [ 65.784892][ T1094] ? __virt_addr_valid+0x183/0x530 [ 65.790010][ T1094] ? __virt_addr_valid+0x183/0x530 [ 65.795112][ T1094] print_report+0x169/0x550 [ 65.799611][ T1094] ? __virt_addr_valid+0x183/0x530 [ 65.804719][ T1094] ? __virt_addr_valid+0x183/0x530 [ 65.809842][ T1094] ? __virt_addr_valid+0x45f/0x530 [ 65.814975][ T1094] ? __phys_addr+0xba/0x170 [ 65.819467][ T1094] ? __lock_acquire+0x78/0x2100 [ 65.824310][ T1094] kasan_report+0x143/0x180 [ 65.828805][ T1094] ? __lock_acquire+0x78/0x2100 [ 65.833676][ T1094] __lock_acquire+0x78/0x2100 [ 65.838433][ T1094] ? mark_lock+0x9a/0x360 [ 65.842753][ T1094] ? __lock_acquire+0x1397/0x2100 [ 65.847764][ T1094] lock_acquire+0x1ed/0x550 [ 65.852279][ T1094] ? lockref_get+0x15/0x60 [ 65.856715][ T1094] ? __pfx_lock_acquire+0x10/0x10 [ 65.861754][ T1094] ? simple_pin_fs+0x91/0x160 [ 65.866433][ T1094] ? do_raw_spin_lock+0x14f/0x370 [ 65.871444][ T1094] ? __pfx_lock_release+0x10/0x10 [ 65.876458][ T1094] _raw_spin_lock+0x2e/0x40 [ 65.880951][ T1094] ? lockref_get+0x15/0x60 [ 65.885395][ T1094] lockref_get+0x15/0x60 [ 65.889677][ T1094] simple_recursive_removal+0x35/0x8f0 [ 65.895137][ T1094] ? mntput+0x65/0xc0 [ 65.899117][ T1094] ? __pfx_remove_one+0x10/0x10 [ 65.903963][ T1094] debugfs_remove+0x49/0x70 [ 65.908479][ T1094] ieee80211_sta_debugfs_remove+0x40/0x60 [ 65.914192][ T1094] __sta_info_destroy_part2+0x35e/0x450 [ 65.919732][ T1094] sta_info_destroy_addr+0xf4/0x140 [ 65.924923][ T1094] ieee80211_destroy_auth_data+0x139/0x270 [ 65.930738][ T1094] ieee80211_sta_work+0x1256/0x3890 [ 65.935930][ T1094] ? mark_lock+0x9a/0x360 [ 65.940258][ T1094] ? __pfx_ieee80211_sta_work+0x10/0x10 [ 65.945794][ T1094] ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10 [ 65.952113][ T1094] ? _raw_spin_unlock_irqrestore+0x8f/0x140 [ 65.957995][ T1094] ? lockdep_hardirqs_on+0x99/0x150 [ 65.963183][ T1094] ? _raw_spin_unlock_irqrestore+0xdd/0x140 [ 65.969065][ T1094] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 65.975384][ T1094] ? skb_dequeue+0x113/0x150 [ 65.979967][ T1094] ? ieee80211_iface_work+0xc0d/0xf20 [ 65.985321][ T1094] ? ieee80211_iface_work+0xe29/0xf20 [ 65.990682][ T1094] ? rcu_is_watching+0x15/0xb0 [ 65.995438][ T1094] cfg80211_wiphy_work+0x2db/0x480 [ 66.000549][ T1094] ? process_scheduled_works+0x976/0x1840 [ 66.006263][ T1094] process_scheduled_works+0xa66/0x1840 [ 66.011799][ T1094] ? __pfx_process_scheduled_works+0x10/0x10 [ 66.017766][ T1094] ? assign_work+0x364/0x3d0 [ 66.022341][ T1094] worker_thread+0x870/0xd30 [ 66.026918][ T1094] ? _raw_spin_unlock_irqrestore+0xdd/0x140 [ 66.032799][ T1094] ? __kthread_parkme+0x169/0x1d0 [ 66.037813][ T1094] ? __pfx_worker_thread+0x10/0x10 [ 66.042938][ T1094] kthread+0x2f0/0x390 [ 66.046997][ T1094] ? __pfx_worker_thread+0x10/0x10 [ 66.052095][ T1094] ? __pfx_kthread+0x10/0x10 [ 66.056670][ T1094] ret_from_fork+0x4b/0x80 [ 66.061072][ T1094] ? __pfx_kthread+0x10/0x10 [ 66.065646][ T1094] ret_from_fork_asm+0x1a/0x30 [ 66.070398][ T1094] [ 66.073399][ T1094] [ 66.075702][ T1094] Allocated by task 46: [ 66.079839][ T1094] kasan_save_track+0x3f/0x80 [ 66.084499][ T1094] __kasan_slab_alloc+0x66/0x80 [ 66.089333][ T1094] kmem_cache_alloc_lru_noprof+0x1dd/0x390 [ 66.095128][ T1094] __d_alloc+0x31/0x700 [ 66.099272][ T1094] d_alloc_parallel+0xdf/0x1600 [ 66.104104][ T1094] __lookup_slow+0x117/0x3f0 [ 66.108681][ T1094] lookup_one_len+0x18b/0x2d0 [ 66.113353][ T1094] start_creating+0x187/0x310 [ 66.118014][ T1094] debugfs_create_dir+0x25/0x430 [ 66.122937][ T1094] ieee80211_sta_debugfs_add+0x132/0x820 [ 66.128572][ T1094] sta_info_insert_rcu+0xecf/0x1900 [ 66.133768][ T1094] sta_info_insert+0x16/0xc0 [ 66.138369][ T1094] ieee80211_prep_connection+0xecd/0x12d0 [ 66.144097][ T1094] ieee80211_mgd_auth+0xd42/0x14c0 [ 66.149207][ T1094] cfg80211_mlme_auth+0x59f/0x970 [ 66.154245][ T1094] cfg80211_conn_do_work+0x5ed/0xe60 [ 66.159524][ T1094] cfg80211_conn_work+0x27c/0x4d0 [ 66.164549][ T1094] process_scheduled_works+0xa66/0x1840 [ 66.170079][ T1094] worker_thread+0x870/0xd30 [ 66.174650][ T1094] kthread+0x2f0/0x390 [ 66.178709][ T1094] ret_from_fork+0x4b/0x80 [ 66.183129][ T1094] ret_from_fork_asm+0x1a/0x30 [ 66.187874][ T1094] [ 66.190192][ T1094] Freed by task 0: [ 66.193906][ T1094] kasan_save_track+0x3f/0x80 [ 66.198567][ T1094] kasan_save_free_info+0x40/0x50 [ 66.203575][ T1094] __kasan_slab_free+0x59/0x70 [ 66.208325][ T1094] kmem_cache_free+0x195/0x410 [ 66.213078][ T1094] rcu_core+0xaaa/0x17a0 [ 66.217308][ T1094] handle_softirqs+0x2d4/0x9b0 [ 66.222059][ T1094] __irq_exit_rcu+0xf7/0x220 [ 66.226636][ T1094] irq_exit_rcu+0x9/0x30 [ 66.230868][ T1094] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 66.236501][ T1094] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 66.242477][ T1094] [ 66.244783][ T1094] Last potentially related work creation: [ 66.250565][ T1094] kasan_save_stack+0x3f/0x60 [ 66.255234][ T1094] __kasan_record_aux_stack+0xac/0xc0 [ 66.260591][ T1094] call_rcu+0x167/0xa70 [ 66.264736][ T1094] __dentry_kill+0x497/0x630 [ 66.269313][ T1094] dput+0x19f/0x2b0 [ 66.273108][ T1094] simple_recursive_removal+0x2bd/0x8f0 [ 66.278647][ T1094] debugfs_remove+0x49/0x70 [ 66.283142][ T1094] ieee80211_debugfs_recreate_netdev+0xc4/0x1400 [ 66.289463][ T1094] drv_remove_interface+0x1e1/0x590 [ 66.294647][ T1094] ieee80211_change_mac+0xaf5/0x11e0 [ 66.299922][ T1094] dev_set_mac_address+0x327/0x510 [ 66.305024][ T1094] dev_set_mac_address_user+0x31/0x50 [ 66.310387][ T1094] dev_ifsioc+0xbd9/0xe70 [ 66.314705][ T1094] dev_ioctl+0x719/0x1340 [ 66.319020][ T1094] sock_do_ioctl+0x240/0x460 [ 66.323597][ T1094] sock_ioctl+0x626/0x8e0 [ 66.327910][ T1094] __se_sys_ioctl+0xf5/0x170 [ 66.332485][ T1094] do_syscall_64+0xf3/0x230 [ 66.336977][ T1094] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 66.342862][ T1094] [ 66.345181][ T1094] The buggy address belongs to the object at ffff888011d45be8 [ 66.345181][ T1094] which belongs to the cache dentry of size 312 [ 66.358791][ T1094] The buggy address is located 208 bytes inside of [ 66.358791][ T1094] freed 312-byte region [ffff888011d45be8, ffff888011d45d20) [ 66.372585][ T1094] [ 66.374901][ T1094] The buggy address belongs to the physical page: [ 66.381302][ T1094] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11d44 [ 66.390094][ T1094] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 66.398586][ T1094] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 66.406136][ T1094] page_type: f5(slab) [ 66.410111][ T1094] raw: 00fff00000000040 ffff88801baff8c0 dead000000000100 dead000000000122 [ 66.418677][ T1094] raw: 0000000000000000 0000000000150015 00000001f5000000 0000000000000000 [ 66.427251][ T1094] head: 00fff00000000040 ffff88801baff8c0 dead000000000100 dead000000000122 [ 66.435914][ T1094] head: 0000000000000000 0000000000150015 00000001f5000000 0000000000000000 [ 66.444590][ T1094] head: 00fff00000000001 ffffea0000475101 ffffffffffffffff 0000000000000000 [ 66.453257][ T1094] head: 0000000000000002 0000000000000000 00000000ffffffff 0000000000000000 [ 66.461933][ T1094] page dumped because: kasan: bad access detected [ 66.468340][ T1094] page_owner tracks the page as allocated [ 66.474039][ T1094] page last allocated via order 1, migratetype Reclaimable, gfp_mask 0xd20d0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_RECLAIMABLE), pid 5214, tgid 5214 (udevd), ts 33674430502, free_ts 33623152908 [ 66.496516][ T1094] post_alloc_hook+0x1f3/0x230 [ 66.501296][ T1094] get_page_from_freelist+0x365c/0x37a0 [ 66.506830][ T1094] __alloc_pages_noprof+0x292/0x710 [ 66.512019][ T1094] alloc_pages_mpol_noprof+0x3e8/0x680 [ 66.517464][ T1094] alloc_slab_page+0x6a/0x140 [ 66.522152][ T1094] allocate_slab+0x5a/0x2f0 [ 66.526640][ T1094] ___slab_alloc+0xcd1/0x14b0 [ 66.531304][ T1094] __slab_alloc+0x58/0xa0 [ 66.535614][ T1094] kmem_cache_alloc_lru_noprof+0x26c/0x390 [ 66.541430][ T1094] __d_alloc+0x31/0x700 [ 66.545586][ T1094] d_alloc_parallel+0xdf/0x1600 [ 66.550429][ T1094] path_openat+0x9e6/0x3590 [ 66.554935][ T1094] do_filp_open+0x27f/0x4e0 [ 66.559509][ T1094] do_sys_openat2+0x13e/0x1d0 [ 66.564181][ T1094] __x64_sys_openat+0x247/0x2a0 [ 66.569019][ T1094] do_syscall_64+0xf3/0x230 [ 66.573520][ T1094] page last free pid 5210 tgid 5210 stack trace: [ 66.579826][ T1094] free_unref_page+0xdef/0x1130 [ 66.584659][ T1094] __put_partials+0xeb/0x130 [ 66.589234][ T1094] put_cpu_partial+0x17c/0x250 [ 66.593994][ T1094] __slab_free+0x2ea/0x3d0 [ 66.598417][ T1094] qlist_free_all+0x9a/0x140 [ 66.602998][ T1094] kasan_quarantine_reduce+0x14f/0x170 [ 66.608457][ T1094] __kasan_slab_alloc+0x23/0x80 [ 66.613299][ T1094] __kmalloc_noprof+0x236/0x4c0 [ 66.618139][ T1094] tomoyo_realpath_from_path+0xcf/0x5e0 [ 66.623670][ T1094] tomoyo_check_open_permission+0x258/0x4f0 [ 66.629550][ T1094] security_file_open+0xac/0x250 [ 66.634477][ T1094] do_dentry_open+0x328/0x1b70 [ 66.639229][ T1094] vfs_open+0x3e/0x330 [ 66.643309][ T1094] path_openat+0x2c84/0x3590 [ 66.647883][ T1094] do_filp_open+0x27f/0x4e0 [ 66.652377][ T1094] do_sys_openat2+0x13e/0x1d0 [ 66.657060][ T1094] [ 66.659377][ T1094] Memory state around the buggy address: [ 66.664988][ T1094] ffff888011d45b80: fb fb fb fb fb fc fc fc fc fc fc fc fc fa fb fb [ 66.673048][ T1094] ffff888011d45c00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 66.681090][ T1094] >ffff888011d45c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 66.689133][ T1094] ^ [ 66.695029][ T1094] ffff888011d45d00: fb fb fb fb fc fc fc fc fc fc fc fc fa fb fb fb [ 66.703078][ T1094] ffff888011d45d80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 66.711124][ T1094] ================================================================== [ 66.719202][ T1094] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 66.726389][ T1094] CPU: 1 UID: 0 PID: 1094 Comm: kworker/u8:6 Not tainted 6.13.0-rc1-syzkaller-00230-g15bfb14727bc #0 [ 66.737223][ T1094] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/25/2024 [ 66.747285][ T1094] Workqueue: events_unbound cfg80211_wiphy_work [ 66.753538][ T1094] Call Trace: [ 66.756823][ T1094] [ 66.759743][ T1094] dump_stack_lvl+0x241/0x360 [ 66.764430][ T1094] ? __pfx_dump_stack_lvl+0x10/0x10 [ 66.769618][ T1094] ? __pfx__printk+0x10/0x10 [ 66.774196][ T1094] ? rcu_is_watching+0x15/0xb0 [ 66.778959][ T1094] ? lock_release+0xbf/0xa30 [ 66.783545][ T1094] ? vscnprintf+0x5d/0x90 [ 66.787865][ T1094] panic+0x349/0x880 [ 66.791821][ T1094] ? check_panic_on_warn+0x21/0xb0 [ 66.796925][ T1094] ? __pfx_panic+0x10/0x10 [ 66.801330][ T1094] ? do_raw_spin_unlock+0x13c/0x8b0 [ 66.806520][ T1094] ? _raw_spin_unlock_irqrestore+0xdd/0x140 [ 66.812399][ T1094] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 66.818719][ T1094] ? print_report+0x502/0x550 [ 66.823392][ T1094] check_panic_on_warn+0x86/0xb0 [ 66.828325][ T1094] ? __lock_acquire+0x78/0x2100 [ 66.833166][ T1094] end_report+0x77/0x160 [ 66.837397][ T1094] kasan_report+0x154/0x180 [ 66.841894][ T1094] ? __lock_acquire+0x78/0x2100 [ 66.846751][ T1094] __lock_acquire+0x78/0x2100 [ 66.851421][ T1094] ? mark_lock+0x9a/0x360 [ 66.855752][ T1094] ? __lock_acquire+0x1397/0x2100 [ 66.860778][ T1094] lock_acquire+0x1ed/0x550 [ 66.865266][ T1094] ? lockref_get+0x15/0x60 [ 66.869693][ T1094] ? __pfx_lock_acquire+0x10/0x10 [ 66.874793][ T1094] ? simple_pin_fs+0x91/0x160 [ 66.879506][ T1094] ? do_raw_spin_lock+0x14f/0x370 [ 66.884556][ T1094] ? __pfx_lock_release+0x10/0x10 [ 66.889603][ T1094] _raw_spin_lock+0x2e/0x40 [ 66.894123][ T1094] ? lockref_get+0x15/0x60 [ 66.898538][ T1094] lockref_get+0x15/0x60 [ 66.902784][ T1094] simple_recursive_removal+0x35/0x8f0 [ 66.908236][ T1094] ? mntput+0x65/0xc0 [ 66.912206][ T1094] ? __pfx_remove_one+0x10/0x10 [ 66.917046][ T1094] debugfs_remove+0x49/0x70 [ 66.921543][ T1094] ieee80211_sta_debugfs_remove+0x40/0x60 [ 66.927259][ T1094] __sta_info_destroy_part2+0x35e/0x450 [ 66.932834][ T1094] sta_info_destroy_addr+0xf4/0x140 [ 66.938057][ T1094] ieee80211_destroy_auth_data+0x139/0x270 [ 66.943873][ T1094] ieee80211_sta_work+0x1256/0x3890 [ 66.949078][ T1094] ? mark_lock+0x9a/0x360 [ 66.953410][ T1094] ? __pfx_ieee80211_sta_work+0x10/0x10 [ 66.958953][ T1094] ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10 [ 66.965279][ T1094] ? _raw_spin_unlock_irqrestore+0x8f/0x140 [ 66.971162][ T1094] ? lockdep_hardirqs_on+0x99/0x150 [ 66.976350][ T1094] ? _raw_spin_unlock_irqrestore+0xdd/0x140 [ 66.982237][ T1094] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 66.988551][ T1094] ? skb_dequeue+0x113/0x150 [ 66.993134][ T1094] ? ieee80211_iface_work+0xc0d/0xf20 [ 66.998495][ T1094] ? ieee80211_iface_work+0xe29/0xf20 [ 67.003864][ T1094] ? rcu_is_watching+0x15/0xb0 [ 67.008619][ T1094] cfg80211_wiphy_work+0x2db/0x480 [ 67.013840][ T1094] ? process_scheduled_works+0x976/0x1840 [ 67.019587][ T1094] process_scheduled_works+0xa66/0x1840 [ 67.025129][ T1094] ? __pfx_process_scheduled_works+0x10/0x10 [ 67.031106][ T1094] ? assign_work+0x364/0x3d0 [ 67.035681][ T1094] worker_thread+0x870/0xd30 [ 67.040273][ T1094] ? _raw_spin_unlock_irqrestore+0xdd/0x140 [ 67.046197][ T1094] ? __kthread_parkme+0x169/0x1d0 [ 67.051214][ T1094] ? __pfx_worker_thread+0x10/0x10 [ 67.056311][ T1094] kthread+0x2f0/0x390 [ 67.060372][ T1094] ? __pfx_worker_thread+0x10/0x10 [ 67.065485][ T1094] ? __pfx_kthread+0x10/0x10 [ 67.070064][ T1094] ret_from_fork+0x4b/0x80 [ 67.074467][ T1094] ? __pfx_kthread+0x10/0x10 [ 67.079043][ T1094] ret_from_fork_asm+0x1a/0x30 [ 67.083793][ T1094] [ 67.086960][ T1094] Kernel Offset: disabled [ 67.091278][ T1094] Rebooting in 86400 seconds..